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Abstract — Modern distributed storage systems apply redun- 
dancy coding techniques to stored data. One form of redundancy 
is based on regenerating codes, which can minimize the repair 
bandwidth, i.e., the amount of data transferred when repairing a 
failed storage node. Existing regenerating codes mainly require 
surviving storage nodes encode data during repair. In this paper, 
we study functional minimum storage regenerating (FMSR) codes, 
which enable uncoded repair without the encoding requirement in 
surviving nodes, while preserving the minimum repair bandwidth 
guarantees and also minimizing disk reads. Under double-fault 
tolerance settings, we formally prove the existence of FMSR 
codes, and provide a deterministic FMSR code construction 
that can significantly speed up the repair process. We further 
implement and evaluate our deterministic FMSR codes to show 
the benefits. Our work is built atop a practical cloud storage 
system that implements FMSR codes, and we provide theoretical 
validation to justify the practicality of FMSR codes. 

I. Introduction 

We have witnessed the wide deployment of storage systems 
in Internet-wide distributed settings, such as peer-to-peer stor- 
age (e.g., IH, El, 0, E3) and cloud storage (e.g., GFS ® 
and Azure (4)), in which data is striped over multiple storage 
nodes interconnected in a networked environment. For data 
availability, a storage system must keep users' data for a long 
period of time and allow users to access their data if necessary. 
However, storage nodes are prone to failures J8), as they are 
often deployed in commodity machines. It is thus important 
for a storage system to ensure data availability in practical 
deployment. 

One way to ensure data availability is to store redundant 
data over multiple storage nodes. Redundancy can be achieved 
via maximum distance separable (MDS) codes such as Reed- 
Solomon codes ff8l . whose idea is that even if any subset 
of nodes fail, the original data remains accessible from the 
remaining surviving nodes. In general, Reed-Solomon codes 
have significantly less redundancy overhead than simple repli- 
cation of data under the same fault tolerance requirement. 

When a storage node fails, it is necessary to recover the 
lost data of the failed node to preserve the required level of 
fault tolerance. Regenerating codes Q have been proposed to 
minimizing the repair bandwidth, which defines the amount 
of data traffic transferred in the repair process. Regenerating 
codes are built on network coding Q], such that to repair a 
failed node, existing surviving nodes encode their own stored 
data and send the encoded data to the new node, which then 
reconstructs the lost data. It is shown that regenerating codes 



use less repair bandwidth than Reed-Solomon codes, given the 
same storage overhead and fault tolerance requirements. 

However, there are challenges of deploying regenerating 
codes in practice. First, most regenerating code constructions 
(e.g., ED, @, 0, El, El, El) require storage nodes 
encode stored data during repair. This may not be feasible 
for some storage devices (e.g., raw harddisks) that merely 
provide the basic I/O functionalities without any encoding 
capabilities. More importantly, even if storage nodes have 
encoding capabilities, they must first read all available data 
from disk and combine the data into encoded form before 
transmitting encoded data for repair. This leads to high disk 
reads, which may degrade the actual repair performance. 

On the applied side, a cloud storage system NCCloud 
iflOl proposes and implements functional minimum storage 
regenerating (FMSR) codes, which have several key prop- 
erties: (i) FMSR codes are MDS codes and have the same 
redundancy overhead as Reed-Solomon codes under the same 
fault tolerance level; (ii) FMSR codes preserve the benefits of 
network coding as they minimize the repair bandwidth (e.g., 
the repair bandwidth saving compared to RAID-6 codes is 
up to 50% IflOl ); and (iii) FMSR codes use uncoded repair 
without requiring encoding of surviving nodes during repair, 
and this can minimize disk reads as the amount of data read 
from disk is the same as that being transferred. FMSR codes 
are designed as non-systematic codes as they do not keep 
the original uncoded data as their systematic counterparts, 
but instead store only linearly combinations of original data 
called parity chunks. Each round of repair regenerates new 
parity chunks for the new node, as long as the fault tolerance 
level is maintained. A trade-off of FMSR codes is that the 
whole encoded file must be decoded first if parts of a file are 
accessed. Nevertheless, FMSR codes are suited to long-term 
archival storage applications since: (i) data backups are rarely 
read and (ii) it is common to restore the whole file rather than 
file parts. 

While FMSR codes have been experimented on real-life 
cloud testbeds, there remain open issues regarding whether 
FMSR codes exist and how they are deterministically con- 
structed. In particular, given that new parity chunks are re- 
generated in each round of repair, we need to ensure that 
such chunks preserve the fault tolerance of MDS codes after 
multiple rounds of repair is necessary. Thus, the key motiva- 
tion of this work is to provide theoretical foundations for the 
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practicality of FMSR codes. 

In this paper, we conduct formal analysis on the existence 
of FMSR codes and provide a deterministic construction for 
FMSR codes, with an objective of theoretically validating the 
practicality of FMSR codes in distributed storage systems. 
We focus on the double-fault tolerance setting (i.e., at most 
two node failures can be tolerated) as in conventional RAID-6 
codes lTT2l . Note that double-fault tolerance is by default used 
in practical cloud storage systems such as GFS JD and Azure 
J4). Our contributions are three-fold. 

> We formally prove the existence of FMSR codes with 
uncoded repair, such that the fault tolerance of MDS 
codes is preserved after any number of rounds of repair. 

> We provide a deterministic FMSR code construction, 
such that the repair can deterministically specify (i) the 
chunks to be read from surviving nodes and (ii) the 
encoding coefficients used to regenerate new chunks. This 
significantly speeds up the repair time compared to the 
random FMSR code construction used in NCCloud iflOl . 

• We build and evaluate our deterministic FMSR codes, and 
show that the chunk selection and regeneration during 
repair can be finished within less than one second. 

The rest of the paper proceeds as follows. Sectionllllreviews 
related work. Section [Til] characterizes the system model of 
FMSR codes and formulates the problems. SectionHVlformallv 
proves the existence of FMSR codes. Section [V] provides a 
deterministic FMSR code construction. Section [VI] presents 
evaluation results. Section [VTT1 concludes the paper. 

II. Background and Related Work 

Dimakis et al. |7J first propose regenerating codes based 
on network coding JT] for distributed storage systems. It 
is shown that when repairing a single failed storage node, 
regenerating codes use less repair bandwidth than conventional 
Reed-Solomon codes ifLSl by transmitting encoded data from 
the surviving nodes to a new node. Also, (7) gives an optimal 
tradeoff spectrum between storage cost and repair bandwidth 
and identifies two extreme points. One extreme point refers 
to the minimum storage regenerating (MSR) codes, in which 
each node stores the minimum amount of data as in Reed- 
Solomon codes. Another extreme point is the minimum band- 
width regenerating (MBR) codes, which allow each node to 
store more data than in conventional Reed-Solomon codes to 
minimize the repair bandwidth. In this work, we focus on the 
MSR codes, so that we can fairly compare with conventional 
Reed-Solomon codes under the same storage overhead. 

As shown in (7), (28), HD, the MSR point is achievable 
under functional-repair, which means that the repaired data 
may not be the same as the lost data while still maintaining the 
same fault tolerance level. However, the corresponding coding 
schemes perform random linear coding in surviving nodes and 
do not provide explicit construction. Then there are extensive 
studies (e.g., (29), (6), 0, ||23), ED, ED) on the exact- 
repair MSR (EMSR) codes, in which the data reconstructed 
is identical to the lost data. 



Most EMSR codes require storage nodes encode stored 
data during repair. Authors in |[T9) , ||20) propose regenerating 
codes that eliminate encoding of storage nodes during repair. 
We call it uncoded repair 1191 , or repair-by-transfer 1201 . 
However, their constructions belong to MBR codes. EMSR 
code constructions based on uncoded repair have been pro- 
posed in (24), ESI- The EMSR code in (ED has the uncoded 
repair property for systematic nodes that store original data 
chunks but not for the parity nodes that store encoded chunks, 
while that in li26) has the uncoded repair property for both 
systematic and parity nodes. However, the code construction 
in |26) requires the total number of data chunks being stored 
increase exponentially with the number of systematic nodes. 
This increases the number of chunk accesses, and limits its 
application in practical storage systems. 

Several studies (e.g., l25l . l30) . lfl3l ) propose uncoded re- 
pair schemes that minimize disk reads for XOR-based erasure 
codes. Their solutions are built on existing code constructions. 
In general, they do not achieve the global minimum point. 

A recent applied work IflOl builds a network-coding-based 
cloud storage system called NCCloud. The authors build and 
evaluate functional MSR (FMSR) codes, which minimize the 
repair bandwidth using uncoded repair. We formally describe 
the FMSR code design in Section [III] Later in 11221 . the 
correctness of FMSR codes is analyzed for a special case of 
two systematic nodes. In this paper, we generalize the analysis, 
and also provide a deterministic code construction, for more 
systematic nodes. 

III. System Model for FMSR Codes 
A. Basics of FMSR Codes 

We first describe the basics of FMSR codes, which are 
used by NCCloud (TO) to store files over multiple independent 
storage nodes. Each node could be a disk device, a storage 
server, or a cloud storage provider. NCCloud motivates using 
FMSR codes to provide fault-tolerant, long-term archival stor- 
age using multiple clouds, so as to save the monetary cost in 
migrating data between cloud providers during repair. FMSR 
codes have three design properties, which we elaborate below. 

Property 1: FMSR codes are MDS codes. FMSR codes 
belong to MDS codes defined by two parameters n and k 
(k < n). An (n, fc)-MDS code divides a file of size M into 
k pieces of size M/k each, and encodes them into n pieces 
such that any k out of n encoded pieces suffice to recover the 
original file. By storing the n encoded pieces over n nodes, 
a storage system can tolerate at most n — k node failures. An 
example of MDS codes is Reed-Solomon codes ffT8l - 

Figure Q] shows the FMSR codes for a special case n = 4 
and k = 2. To store a file of size M units, an (n, fc)-FMSR 
code splits the file evenly into k(n — k) native chunks, say 
Fi, F2, . . . , Fu n -k\i an d encodes them into n(n — k) parity 
chunks of size kt ^f_ k ^ each. Each I th parity chunk is formed 
by a linear combination of the k(n — k) native chunks, i.e, 
Sm=l a l,m,Fm for some encoding coefficients a^ m . All 
encoding coefficients and arithmetics are operated over a finite 
field F g of size q. We store the n(n — k) parity chunks on n 
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Fig. 1. FMSR codes with n = 4 and k = 2. 

nodes, each keeping n — k parity chunks. Note that no native 
chunk is stored. The original file can be restored by decoding 
k{n — k) parity chunks of any k nodes, where decoding can 
be done by inverting an encoding matrix |[T6l . Let Pij be the 
jth p^ity chunk stored on node i, where i = 1, 2, . . . , n and 
j = 1, . . . , n — k. 

Property 2: FMSR codes minimize the repair bandwidth. 
If a node fails, we must reconstruct the lost data of the failed 
node to preserve fault tolerance. The conventional repair of 
Reed-Solomon codes reads k pieces from any k surviving 
nodes to restore the original file (by the design of MDS codes). 
Clearly, the amount of data read is the file size M. FMSR 
codes seek to read less than M units of data to reconstruct 
the lost data. We define repair bandwidth as the amount of 
data read from surviving nodes during repair. FMSR codes are 
designed to match the minimum storage point of regenerating 
codes when repairing a node failure 0, while having each 
node store M/k units of data as in Reed-Solomon codes. 
To repair a failed node in FMSR codes, each surviving node 
transfers data of size fc ^ fc ) urnts as m Q> or equivalently, 
a size of one parity chunk. In a special case of n = 4 and 
k = 2 (see Figure [T), the repair bandwidth is 0.75M, i.e., 
25% less than that of conventional repair of Reed-Solomon 
codes. In general, the repair bandwidth of FMSR codes for 
k = n — 2 is & 2(n-2) ' anc ^ ' ts savm § compared to RAID-6 
codes ifTZl (which are also double-fault tolerant) is up to 50% 
if n is large iflOl . 

Property 3: FMSR codes use uncoded repair. During 
repair, each surviving node under FMSR codes transfers one 
parity chunk, without any encoding operations. This also 
minimizes the amount of data read from disk. Suppose we 
have a failed node I (e.g., I = 1 in Figure [TJ. Then we read 
one parity chunk denoted by Pijt^i) from each surviving node 
i, where 1 < i < n and i ^ I, and /(.) denotes some function 
that specifies which chunk to be read from a surviving node. 
Then we encode the n — 1 parity chunks into n — k linearly 
independent parity chunks P/ l7 P/ 2 , . . . P[ n _ k , which will all 
be stored in a new node, which becomes the new node / (called 
the repaired node). Each new parity chunk is generated by: 



i=l, i=£l 



.n-k, (1) 



where jij denotes some coefficient for encoding the collected 
parity chunks into new chunks. In Section [V] we formally 
specify how we choose /(.) and 7^. 

B. Formulation of Repair Problem in FMSR Codes 

We formulate the repair problem in FMSR codes based on 
IfTUl . Note that [ 10] only gives a high-level description, without 
formal definitions and theoretical validations. Here, we provide 
a theoretical framework that formalizes the idea of IflOl . 

FMSR codes satisfy the MDS property, as described below. 

Definition 1: MDS property. For any subset of k out of n 
nodes, if the k(n — k) parity chunks from the k nodes can 
be decoded to the k{n — k) native chunks of the original file, 
then the MDS property is satisfied. □ 

Definition 2: Decodability. We say that a collection of 
k(n — k) parity chunks is decodable if the parity chunks 
can be decoded to the original file, which can be verified 
by checking if the associated k(n — k) encoding vectors are 
linearly independent. Note that these k(n — k) chunks may be 
scattered among n nodes, and need not reside in k nodes. □ 

Note that FMSR codes operate on parity chunks. For 
simplicity, when we use the term "chunk" in our discussion, 
we actually refer to a parity chunk. 

Since FMSR codes regenerate different chunks in each 
repair, one design challenge of FMSR codes is to preserve the 
MDS property after multiple rounds of repairs. We illustrate 
with an example in Figure [T] Suppose that node 1 fails, and we 
construct new chunks P[ l and P'^ Y using i-2,1, P$,\, and P41 
as in Figure Q] Next, suppose that node 2 fails. If we construct 
new chunks P 2 l and P' 2 2 using P[ t , -P3.1, and Pa : \, then in 
the repaired nodes 1 and 2, the chunks {P{ l: P{ 2 , P' 2 1, P'2 2} 
are the linear combinations of only three chunks P2.1, ^3,1, 
and P4 .1 instead of four. So the chunks in the repaired nodes 1 
and 2 are not decodable, and the MDS property is lost. 

Thus, to preserve the MDS property over multiple rounds 
of repair, NCCIoud uses a specific implementation of FMSR 
codes based on random chunk selection, which we call 
random FMSR codes. NCCIoud seeks to completely avoid 
linear dependence in chunk regeneration and hence losing the 
MDS property. Specifically, NCCIoud performs the r th (where 
r > 1) round of repair as follows: 

(i) It randomly selects a chunk from each surviving node 
(i.e., /(.) returns a random value), and generates random 
encoding coefficients to encode the selected chunks into 
new chunks (i.e., 7i./s are randomly chosen). 

(ii) It then performs two-phase checking. In the first phase, 
it checks if the MDS property is satisfied with the new 
chunks generated (i.e., the chunks of any k out of n 
nodes remain decodable) after the current r th round of 
repair. In the second phase, it further checks if the MDS 
property is still satisfied after the (r + l) th round of 
repair for any possible node failure, and this property is 
called the repair MDS property. 

(iii) If both phases are passed, then NCCIoud writes the 
generated chunks to a new node; otherwise, it repeats (i) 
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and (ii) with another set of random chunks and random 
encoding coefficients. 

We now formally define the repair MDS property. 

Definition 3: Repair-based collections (RBCs). An RBC of 
the r th round of repair is a collection of k(n — k) chunks that 
can be obtained after the r th round of repair by the following 
procedure. (Step 1) We select any n— 1 out of n nodes. (Step 
2) We select k — 1 out of the n — 1 nodes found in Step 1 and 
collect n — k chunks from each selected node. (Step 3) We 
collect one chunk from each of the non-selected n — k nodes. 
Clearly, the number of collected chunks is (k — l)(n — k) + 
(n — k) — k(n — k). □ 

We can easily verify that there are ( " 1 ) (i!Zi)( n ~ k) n ~ k 
different RBCs. Intuitively, an RBC refers to a collection of 
chunks of k nodes after the (r + l) th round of repair for any 
possible node failure. For instance, after repairing node 1 in 
Figure [T] one example RBC is 1Z = {P{ l7 P3.1, P3.2, Pt,i}- 
This means that we assume: node 2 is the failed node in the 
next round of repair; the failed node 2 will be repaired by 
chunks P{ y, P3.1 (or Ps^), and P^i; and we consider if the 
chunks of node 2 (after repair) and node 3 are decodable. Note 
that the chunks of node 2 and node 3 are linear combinations 
of this RBC K. 

We assume that when a file is stored, it is first encoded using 
Reed-Solomon codes, such that any k(n — k) out of n(n — k) 
(parity) chunks are decodable. Note that these k(n — k) chunks 
may reside in more than k nodes (e.g., Pi,i, p2,i, ^3,1, Pi,i 
in Figure [TJ. If no repair is carried out, then we ensure that 
every possible RBC is decodable. 

However, after repairing a node failure, there exist 
some non-decodable RBCs. For example, in Figure Q] 
the RBCs {P{,i,P{, 2j P 2 ,i,P3,i}, {P{,i, P{, 2 , P 2 ,i, Pi,i}, and 
{P[ j, P[ 2 7 P3,]., P4.1} are non-decodable, since P[ x and P[ 2 
are linear combinations of P2.1, P3.1, P&,\. Note that these 
non-decodable RBCs all contain the chunks of the repaired 
node 1 . Each of these RBCs is linearly combined with chunks 
p2,i, P3.i1 Pt,i (i- e -i l ess than four chunks) in the repair. 
Accordingly, we define the following: 

Definition 4: Linear Dependent Collection (LDC). Suppose 
that an RBC of the r th round of repair contains the n — k 
chunks of the repaired node that are collected in Step 2 (see 
Definition |3). If this RBC is linearly combined with a set of 
less than k(n — k) chunks of the r th round of repair, then it 
is called an LDC of the r th round of repair. □ 

Definition 5: Repair MDS (rMDS) property. If all RBCs, 
after excluding the LDCs, of the r th round of repair are 
decodable, then we say the rMDS property is satisfied. □ 

Definition 6: (n,k)-FMSR codes. An original file is stored 
in n nodes in the form of n(n — k) chunks. If these n(n — k) 
chunks satisfy both the MDS and rMDS properties, then we 
say this file is FMSR-encoded. 

Summary. Authors of NCCloud iflOl show via simulations 
that by checking both the MDS and rMDS properties in each 
round of repair, FMSR codes can preserve the MDS property 
after hundreds of rounds of repair. Also, if we check only 
the MDS property but not the rMDS property, then after some 



rounds of repair we cannot regenerate the chunks that preserve 
the MDS property within a fixed number of iterations (this 
is called the bad repair ifTOl ). On the other hand, there is 
no formal theoretical analysis showing the need of two-phase 
checking to preserve the MDS property after any number of 
rounds of repair. Also, random FSMR codes repeat two-phase 
checking until the valid chunks are regenerated. This could 
involve many iterations and significantly increase the repair 
time overhead (see Section IVD . In the following sections, 
we formally provide the theoretical validation of existence of 
FMSR codes and the design of deterministic FMSR codes. 

IV. Existence 

We now prove the existence of FMSR codes. In this work, 
we focus on k = n — 2, implying that FMSR codes are double- 
fault tolerant as conventional RAID-6 codes [12|. Double-fault 
tolerance has been assumed in practical cloud storage systems 
(e.g., GFS HI and Azure Jffl). Our goal is to show that FMSR 
codes always maintain double-fault tolerance (i.e., the MDS 
property is always satisfied with k = n — 2) after any number 
of rounds of uncoded repair, while the repair bandwidth is 
kept at the MSR point. 

We first give three lemmas. Lemmas Q] and [2] provide a 
guideline of how to choose n — 1 chunks from n — 1 surviving 
nodes (one chunk from each node) to repair a failed node. 
Lemma [3] implies that if the finite field size is large enough, 
then we can always find a set of encoding coefficients to 
regenerate new chunks for a repaired node so as to maintain 
the MDS and rMDS properties after each round of repair. 
Finally, we prove TheoremQ]for the existence of FMSR codes. 

Lemma 1: In repair, let T be the set of n — 1 chunks 
selected from n — 1 surviving nodes to regenerate the n — k 
chunks of the repaired node. Also, let Q be the set of chunks 
collected in Step 3 of RBC construction (see Definition [3). If 
an RBC (denoted by 1Z) containing the n — k chunks of the 
repaired node is an LDC, then T and Q must have two or 
more common chunks. 

Proof: Without loss of generality, let node 1 be the failed 
node. Let V be the set of chunks collected in Step 2 of 
Definition [3] excluding the n — k chunks of the repaired node 1. 
Thus, K = {Pi Ay . . , P[ n _ k } U V U Q. As P{ A , . . . , P[ n _ k 
are obtained by linearly combining the chunks in J 7 , we infer 
that 1Z is linearly combined with T U V U Q. 

Since T selects one chunk from each of n — 1 surviving 
nodes and V has all the chunks from k — 2 surviving nodes, 
T and V have k — 2 identical chunks, i.e., | T D V\ = k — 2. 
According to the given conditions, we can easily have the 
following equalities: jj 7 ! = n — 1, \V\ = (k — 2)(n — fc), 
|Q| = n - k, \V n Q\ = I J" n V n Q\ = 0. Finally we can 
have |J-UPU Q\ = \F\ + \V\ + \Q\ - \TnV\ - \Tn Q\ - 
|Pn Q\ + |J"nPn Q\ = k(n-k) + l-\J r nQ\. Since K 
is an LDC, | T U V U Q| < k(n - k). Hence, \T n Q\ > 2. 
Lemma Q] holds . ■ 

Lemma 2: Suppose that the rMDS property is satisfied after 
every r th round of repair. Then for any n — 1 out of n nodes, 
we can always select one chunk from these n — 1 nodes (i.e., 
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a total of n — 1 chunks) such that any RBC containing the 
selected n — 1 chunks is decodable. 

Proof: Without loss of generality, suppose that we con- 
struct an RBC 1Z by selecting the chunks from nodes 2, . . . , n 
(see Step 1 of Definition [3), and that Q be the set of n — 1 
chunks selected from nodes 2, . . . , n (one chunk from each 
nodes). We prove the existence of Q such that if 1Z contains 
Q (i.e., Q C 1Z), then 1Z is decodable. 

If node 1 is the repaired node in the r th round of repair, 
then 1Z is never an LDC (by Definition g}. Since the rMDS 
property is satisfied by our assumption, 1Z is decodable (by 
Definition |5J. 

If node 1 is not the repaired node in the r round of repair, 
then without loss of generality, let node 2 be the repaired 
node. By the FMSR design, the chunks of node 2 are linearly 
combined by one chunk in each of nodes 1,3, ...,n. We 
denote these chunks by T = P 3J(3) , . . . , P„ J(ll) }. 

Since each node has n — k > 1 chunks, we can construct Q = 
p 2, g (2), ■ • • , Pn, g { n )} such that g(i) ^ f(i) for i = 3, . . . , n 
(while g{2) can be randomly picked). If 1Z contains Q, then 
in Step 3 of RBC construction (see Definition |3), at least one 
chunk must be selected from Q. However, Q has no identical 
chunk with T. By Lemma [T] 1Z is not an LDC. Since the 
rMDS property is satisfied, 1Z is decodable. ■ 

Lemma 3: (Schwartz-Zippel Theorem) |fT31 . Consider a 
multivariate non-zero polynomial h(xi, . . . , Xt) of total degree 
p over a finite field F. Let § be a finite subset of F, and 
Xi, . . . , it be the values randomly selected from S. Then the 
probability Pv[h(xi, . . . , i t ) =0] < j|y. 

Theorem 1: Consider a file encoded using FMSR codes 
with k = n — 2. In the r th (r > 1) round of uncoded repair of 
some failed node j, the lost chunks are reconstructed by the 
random linear combination of n — 1 chunks selected from n— 1 
surviving nodes (one chunk from each node). Then after the 
repair, the reconstructed file still satisfies both the MDS and 
rMDS properties with probability that can be driven arbitrarily 
to 1 by increasing the field size of ¥ q . 

Proof: We prove by induction on r. Initially, we use Reed- 
Solomon codes to encode a file into n(n~k) = 2n chunks that 
satisfy both the MDS and rMDS properties. Suppose that after 
the r th round of repair, both the MDS and rMDS properties 
are satisfied (this is our induction hypothesis). 

Let U r = {Pi.i, Pi, 2 ; ■ ■ • ; Pk+2,1, Pk+2,2} be the current 
set of chunks after the r th round of repair. In the (r + \) th 
round of repair, without loss of generality, let node 1 be the 
failed node to repair. Since U r satisfies the rMDS property, 
we have the following corollary by Lemma [2] 

Corollary. There exists a set of n — 1 chunks, de- 
noted by T = {P 2 j{2), ■ ■ ■ ,Pk+2j(k+2)}, selected from 
nodes 2, . . . , n, such that any RBC containing T is decodable. 

We use T to repair node 1 . Suppose that the repaired node 1 
has the new chunks \P[ 1 ,P[ 2 }- Then: 



a way that the set of chunks in the (r + 1) round of repair 



r+l 



{PlnPl 



;P fc+ 2,i,Pfc +2 ,2} still satisfies both 



fe+2 



(2) 



i=2 

Next we prove that we can always tune 7^ in ¥ q in such 



MDS and rMDS properties. The proof consists of two parts. 

Part I: U r +\ satisfies the MDS property. Since U r satisfies 
the MDS property, we only need to ensure that for any 
k — 1 surviving nodes, say for any subset {si, . . . , Sfc-i} 
C {2, . . . , n}, all the chunks of nodes si, . . . , Sk-i and the 
repaired node 1 are decodable. Without loss of generality, let 
(si, . . . , s/c-i) = (2, . . . , fc), and other cases are symmetric. 

Let V = {P2,i,P2,2;---;Pk,i,Pk,2;P{ tl> p {2} be the set 
of chunks of nodes 1 to fc. By Equation @, each chunk 
of V is a linear combination of a certain RBC, denoted by 

TZ — {P2.I, P2,2', ■ ■ ■ ! Pk.l, Pk,2i Pk+lJ(k+l), Pk+2,f(k+2)}- 

Mathematically, we express as: 





" P2.1 




P 2 ,i 




P2,2 




P2,2 




Pk,l 


= A x 


Pk,l 




Pk,2 




Pk,2 








Pk+l,f(k+l) 








Pk+2,f(k+2) 


where A is 


a k(n — 


fc) x k(n 


- k) (i.e., 2k x 


matrix given 


by A = 




/ 1,0, 


0,0, 


0,1, 


0,0, 



0,0, 
0,0, 

V ^2472,2, £2,272,2, 



0,0 
0,0 



1,0, 0,0 
0,1, 0,0 

£fc,i7fc,i) £fc,27fc,i> 7fc+i,i>7fc+2,i 

<5fc,l7fc,2, <5fc,27fc,2, 7fc+l,2>7fc+2,2 J 



where Si.i = 1 and 6^2 = when f(i) = 1, and 6^1 — and 
Si.2 = 1 when /(£) = 2. Since 1Z is an RBC containing T, 
it is decodable due to Lemma [2] In addition, the determinant 
det(A) is a multivariate polynomial in terms of variables 7^ . 
By Lemma|3] the value of det(A) is non-zero, with probability 
driven to 1 if we increase the finite field size. Now since 1Z is 
decodable and A has a full rank, V is decodable. This implies 
that U r +i satisfies the MDS property. 

Part II: U r+ i satisfies the rMDS property. By Defini- 
tion [5] we need to prove that all the RBCs of U r +\ except 
the LDCs are decodable. By Definition [3] we consider two 
cases of RBCs. Without loss of generality, we let node 1 be 
the repaired node. 

Case 1: The repaired node 1 is selected in Step 2. Suppose 
in Step 1, an RBC selects any n — 2~k surviving nodes, say 
{si, . . . , s k ] C {2, . . . , n}. Then in Step 2, the RBC further 
selects any subset of fc — 2 nodes, say nodes si, . . . , s k -2- 
The RBC now contains all the chunks of node s\, . . . , s k -2 
and the repaired node 1. Finally, in Step 3, the RBC collects 
two chunks, denoted by P Sk _ l! g( Sk _- L ) and P Sfc . g ( Sfc ) from 
the remaining two nodes Sk-i and s&, respectively. Without 
loss of generality, let (si, . . . , Sk-2) = (2, ...,fc — 1) and 

(s fe _l,Sfc) = (fc, fc+1). 
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Denote the RBC by K x = {P 2 ,i, P2.2; ■ ■ ■ 5 p k-i,i, ffe-1,2; 
p i,n p i,2'i p k,g(k)> p k+i,g(k+i)}- In addition, by Equation ©, 
the chunks of are linear combinations of a set of 
chunks denoted by X = {P 2j i, P 2 ,2\ ■ ■ ■ ; Pfc-i,i, Pfc-1,2; 

P k,g(k) 7 P k,f(k) i P k+l,g(k+l) > P k+l,f(k+l) i P k+2J(k+2) }■ 

Our goal is to show that if is not an LDC, then it is 
decodable. By Lemma [1] we know that if IZi is an LDC, then 
there are at least two chunks selected in Step 3 that belong 
to T = {P2j(2), ■ ■ ■ , p nj{n)} (which are used to regenerate 
chunks for node 1), or equivalently, g(k) = /(fc) and g(k + 
1) = /(fc + 1). Therefore, to prove that IZi except the LDCs is 
decodable, it is equivalent to prove that IZi is decodable when 
(a) g(k) ? /(fc) and g(k + 1) = f(k + 1), (b) g(k) = /(fc) 
and g(k + 1) + 1 f(k + 1), or (c) g(k) ^ f(k) and g(k + 1) ^ 

First consider (a). We can reduce X to {P21, P2.2', ■ ■ ■ ', 
Pfc-1,2; Pfc.i, -Pfc,2! Pfc+i,/(fc+i), P k+2,f(k+2)}- The 
above collection is an RBC containing T. By our corollary, the 
collection is decodable. Therefore, H.\ is linear combination 
of a decodable collection. Then we can use the similar method 
in Part I to prove that there always exists an assignment of 
7ij in a sufficiently large field such that IZi is decodable (by 
Lemma [3). The proof of (b) is similar to that of (a) and is 
thus omitted. 

Lastly, let us consider (c). Now, X can be written 

as {-^2,1) -^2,2; ■ • ■ ; Pfc-l,li Pfc-1,2! Pfc.lj Pk,2'> P k+l,X> Pk+1,2: 

Pk+2j(k+2)}- Define X = X - {Pk+2j k+2 }- Note that the 
MDS property of X is satisfied by induction hypothesis. Thus, 
X is decodable, implying that Pk+2j(k+2) can be seen as 
a linear combination of X. Obviously, we can also say that 
X is a linear combination of X. Therefore, IZi is also a 
linear combination of the decodable collection X. Based on 
the above argument, IZi is decodable. 

Case 2: The repaired node 1 is selected in Step 3. Suppose 
in Step 1, the RBC selects any n — 2 = fc surviving nodes, 
say {si,...,Sfc} C {2, ...,n}. Then in Step 2, the RBC 
further selects any subset of fc — 1 nodes, say s\, . . . , Sk-i 
to collects all the chunks of nodes s\, . . . , Sk-i- Finally, in 
Step 3, the RBC collects two chunks P[ g ,^, and P Sk , g ( Sk ) from 
the repaired node 1 and the last selected node Sfe, respectively. 
Without loss of generality, let (si, . . . , Sk-i) = (2, . . . , fc) and 
Sfc = fc + 1. 

Denote the RBC by TZ 2 = {P 2 ,i, ^2,2! • • • 5 Pfc.i, Pfc,25 
P i g(i)' p k+i.g{k+i) }■ We need to show that if IZ2 is not an 
LDC, it is decodable. Based on Lemma [TJ there is no more 
than one identical chunk between T and the RBC's chunks 
collected in Step 3, so H.2 is never an LDC. We only need to 
prove that every possible 11,2 is decodable. 

By Equation (O, the chunks of H2 are linear combinations 
of a set of chunks denoted by y = {^2,1, P2, 2; ■ • ■ ; Pk,i,Pk, 2 ; 
Pfc + i, 9 (fc+i),Pfc+i,/(fc+i);Pfc +2 ,/(fc+2)}. Suppose g(k+l) ^ 
f(k + 1). Define y = y - {P k+1Mk+1 j}. Since y is 
an RBC containing T, by our corollary, y is decodable. 
Therefore, Pk+i, g (k+i) can be seen as a linear combination 
of y. Obviously, we can also say y is a linear combination of 
y. Therefore, IZ2 is also linear combination of the decodable 



collection y. Similar to the above arguments, IZ2 is decodable. 
If g(k+l) = /(fc + 1), the proof is similar and is thus omitted. 

Combining Case 1 and Case 2, we deduce that all RBCs 
excluding the LDCs are decodable. So U r +i satisfies the rMDS 
Property. Therefore, Theorem [TJ concludes. ■ 

V. Deterministic FMSR Codes 

In NCCloud iflOl . the repair operation under FMSR codes 
is accomplished based on two random processes: (i) using 
random chunk selection to read chunks from the surviving 
nodes and (ii) applying random linear combinations of the 
selected chunks to generate new chunks for the repaired node. 
Section [IV] has proved the correctness of the random-based 
repair operation by virtue of existence of FMSR codes. On 
the other hand, a drawback of the random approach is that it 
may need to try many iterations to generate the correct set of 
chunks that satisfies both the MDS and rMDS properties. 

In this section, we propose a deterministic repair scheme 
under FMSR codes (fc = n — 2), such that both the chunk 
selection and linear combination operations are deterministic. 
This enables us to significantly speed up the repair operation. 
In our deterministic scheme, we specify which particular 
chunk should be read from each surviving node in each 
round of repair. We also derive the sufficient conditions on 
which the encoding coefficients should satisfy. To design the 
deterministic scheme, we first introduce an evolved repair 
MDS property. 

Definition 7: Evolved Repair MDS (erMDS) property. Let 
fc = n — 2. For any fc+1 out of n nodes, if we can always select 
one specific chunk from each of the fc + 1 nodes such that any 
RBC containing these selected fc + 1 chunks is decodable, then 
we say the code scheme has the erMDS property. □ 

From Lemma [2 we can see that if the rMDS property is 
satisfied, then the erMDS property is also satisfied. Thus, any 
RBCs satisfying the rMDS property is a subset of the RBCs 
satisfying the erMDS property. We use the erMDS property 
to construct a deterministic FMSR code. 

To construct deterministic FMSR codes for fc = 11 — 2, we 
describe how we store a file and how we trigger the r th (r > 1) 
round of repair for a node failure. 

Storing a file. We divide a file into k(n — fc) = 2fc 
equal-size native chunks, and encode them into n(n — 
fc) = 2(fc + 2) parity chunks denoted by Pi,i,Pi,2; 
Pfc+2,i,Pfc+2,2 using Reed-Solomon codes, such that any 2fc 
out of 2(fc + 2) chunks are decodable to the original file. 
Each node i (where i = l,2,...,fc + 2) stores two chunks 
Pj : i and P^ 2- Clearly, the generated parity chunks satisfy the 
MDS property (see Definition [TJ, i.e., for any fc out of n 
nodes {si, . . . , s k } C {1, . . . , fc + 2}, the 2fc parity chunks 
{P Sl ,i, p si,2l ■ • ■ ; p s k .ii Psfc.2} are decodable. In addition, the 
generated parity chunks also satisfy the erMDS property (see 
Definition [7), i.e., for any fc+1 nodes sj., . . . , Sfc+i, we can al- 
ways select some specific chunks P ai /( S1 ), ■ • • 3 P s k+1 ,f(s k+1 ) 
such that any RBC containing them is decodable. Here, we 
need to find and record such fc+1 specific chunks for any fc+1 
nodes. For illustrative purposes, we let /(s;) = 1, where i = 
1, 2, . . . , fc + 1, so we record the chunks {P 81 ,x, ■ ■ ■ , Ps k+1 ,i}- 



7 



The first round of repair. Suppose without loss of gener- 
ality that node 1 fails and then is repaired by the following 
two steps. 

Step 1: {Chunk selection) . We select k+1 chunks P24, 
Pk+2,1 that are recorded when the file is stored. 

Step 2: (Coefficient construction). For each selected chunk 
Pi' ,1 (i' = 2, . . . , k + 2), we compute 2k coefficients Af) 
(i = 2,...,k + 2,i^i', j = 1, 2) which satisfy 

k+2 2 

Each parity chunk is a linear combination of k(n — k) = 2k 
native chunks (see Section HIB . By equating the coefficients 
that are multiplied with the 2k native chunks on both left and 
right sides of Equation 01, we obtain 2k equations, which 
allow us to solve for A< „• . 

Next we need to construct the coefficients 7.^1 and 7.^2 
which satisfy the following inequalities 01, and (0: 

7i,l7j,2 7^ 7i,27j,l) ( 4 ) 

where i 7^ j and i, j = 2, 3, . . . , k + 2; 

7i.2+7i',2A|? 7^0, (5) 
where i ^ i' and i, i' g {2, . . . , k + 2}; and 

(7M+7,»,iA£' ) )(7^2+7 4 ",2A l ( f' 1 ) )^ 

(7<M+7iMAif 1 ) )(7 < , a +7<« l2 A i ( ;r ) ). 

where i, i' and i" are distinct, i, i', i" g {2, . . . , k+2}. We can 
then construct the coefficients 7^1 and 7^2, and by Lemma [3] 
the solution exists if the finite field size is large enough. Lastly, 
we regenerate new chunks P[ 1 and P[ 2 as follows: 

= 72,1^2,1 +73,1^3.1 + • ■ ■ +7fe+2,l-Pfe+2,l, (7) 
P l,2 = 72,2^2.1 + 73,2^3,1 + • ■ ■ + 7fc+2,2-Pfc+2.1 ■ (8) 

The r'' 1 round of repair (r > 1). If the failed node in the 
r th round of repair is the repaired node in the (r — l) th round 
of repair, then we just repeat the (r — l) th repair. Otherwise, 
we first select the k+1 chunks such that they are different from 
those selected in the (r — l) th round of repair. Then similar 
to the first round of repair, we generate the coefficients that 
satisfy inequalities likewise in (0, 01, and (0. Finally, we 
regenerate the new chunks accordingly as (0 and (0. 

The correctness of our deterministic FMSR codes is proved 
in Appendix. 

VI. Evaluation 

In this section, we evaluate the repair performance of two 
implementations of FMSR codes: (i) random FMSR codes, 
which use random chunk selection in repair and is used in 
NCCloud iflOl and (ii) deterministic FMSR codes, which use 
deterministic chunk selection proposed in Section [V] We show 
that our proposed deterministic FMSR codes can significantly 
reduce the time required to regenerate parity chunks in repair. 




M QQJ I , , , , , 1 

4 5 6 7 8 9 10 
Number of nodes (n) 



Fig. 2. Aggregate checking time of 50 rounds of repair (y-axis is in log 
scale). 

We implement both versions of FMSR codes in C. We 
implement finite-field arithmetic operations over a Galois Field 
GF(2 8 ) based on the standard table lookup approach Q. We 
conduct our evaluation on a server running on an Intel CPU 
at 2.4GHz. We consider different values of n (i.e., the number 
of nodes). For each n, we first apply Reed-Solomon codes to 
generate the encoding coefficients that will be used to encode 
a file into parity chunks before uploading. In each round of 
repair, we randomly pick a node to fail. We then repair the 
failed node using two-phase checking, based on either random 
or deterministic FMSR code implementations. The failed node 
that we choose is different from that of the previous round of 
repair, so as to ensure a different chunk selection in each round 
of repair. We conduct 50 rounds of repair in each evaluation 
run. We conduct a total of 30 runs over different seeds for 
each n. 

The metric we are interested in is the checking time spent 
on determining if the chunks selected from surviving nodes 
can be used to regenerate the lost chunks. We do not measure 
the times of reading or writing chunks, as they are the same 
for both random and deterministic FMSR codes. Instead, we 
focus on measuring the processing time of two-phase checking 
in each round of repair. It is important to note that two- 
phase checking only operates on encoding coefficients, and 
is independent of the size of the file being encoded. Note 
that we do not specifically optimize our encoding operations, 
but we believe our results provide fair comparison of both 
random and deterministic FMSR codes using our baseline 
implementations . 

Figure first depicts the aggregate checking times for a 
total of 50 rounds of repair versus the number of nodes when 
using random and deterministic FMSR codes. The aggregate 
checking time of random FMSR codes is small when ?? is small 
(e.g., less than 1 second for n < 6), but exponentially increases 
as n is large. On the other hand, the aggregate checking time of 
deterministic FMSR codes is significantly small (e.g., within 
0.2 seconds for n < 10). 

Our investigation finds that the checking time of random 
FMSR codes increases dramatically as the value of n in- 
creases. For example, when n = 12 (not shown in our 
figures), we find that the repair operation of our random 
FMSR code implementation still cannot return a right set of 
regenerated chunks after running for two hours. In contrast, 
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(a) random FMSR codes (b) deterministic FMSR codes 

Fig. 3. Cumulative checking time of r rounds of repair. 
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(a) random FMSR codes (b) deterministic FMSR codes 

4. Cumulative number of two-phase checkings of r rounds of repair. 



our deterministic FMSR codes can return a solution within 
0.5 seconds. 

To further examine the significant performance overhead of 
random FMSR codes, Figures [3] and [4] show the cumulative 
checking time and number of two-phase checkings performed 
for r rounds of repair, respectively, for n = 8,9, 10. We note 
that random FMSR codes incur a fairly large but constant 
number of two-phase checkings in each round of repair. For 
example, for n =10, each round of repair takes around 100 
iterations of two-phase checkings (see Figure H|a)). On the 
other hand, deterministic FMSR codes significantly reduce the 
number of iterations of two-phase checking (e.g., less than 2.5 
on average for n = 10). In summary, our evaluation results 
show that deterministic FMSR codes significantly reduce the 
two-phase checking overhead of ensuring that the MDS prop- 
erty is preserved during repair. 

VII. Conclusions 

This paper formulates an uncoded repair problem based on 
functional minimum storage regenerating (FMSR) codes. We 
formally prove the existence of FMSR codes and provide a 
deterministic FMSR code construction. We also show via our 
evaluation that our deterministic FMSR codes significantly 
reduce the repair time overhead of random FMSR codes. Our 
theoretical results validate the correctness of existing practical 
FMSR code implementation iflOl . We also demonstrate the 
feasibility of preserving the benefits of network coding in 
minimizing the repair bandwidth with uncoded repair. 
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Appendix 

We now prove the correctness of the deterministic FMSR 
codes in Section [V] Initiaially, the file is stored with Reed- 
Solomon codes, such that any 2fc out of 2(fc + 2) (parity) 
chunks are decodable to the original file. Therefore, the set of 
chunks being stored before any repair satisfies the MDS and 
erMDS properties. Now, we show that the MDS and erMDS 
properties are always satisfied after each round of repair, based 
on our chunk selection and coefficient construction. 

The first round of repair. Let U± = {P{ l5 P{ 2 ; P24, P2.25 
. . . ; P n ,i, Pn,2} be the set of all chunks after the first round of 
repair (for failed node 1). Next we prove that U\ still satisfies 
both the MDS and erMDS properties. 

(JA\ satisfies the MDS property) Since the file is stored 
with Reed-Solomon Codes, all the chunks of any k out of 
nodes 2, . . . , k + 2 before the repair are obviously decodable. 
Thus, we only need to check whether the chunks of the 
repaired node 1 and any k — 1 of nodes 2, . . . , k + 2 are 
decodable. Take the repaired node 1 and nodes 2, . . . , k for 
instance. Denote the 2k chunks of them by V = {P[ i,P{ 2 ; 
^2,1,^2,2; Pk, l, Pk, 2}- Consider the linear span of V 
(i.e., the set of all linear combinations of V). Due to Equa- 
tions © and (|8]l, the linear span of V can be expressed as 
span(V) = span(7 fc+li iP fc+li i-|-7fe + 2,iPfc+2,i,7fe+i,2-Pfc+i,i + 
7fc+2,2-Pfc+2,i;P2,i,P2,2; Pfc,i,Pfc,2)- Note that the co- 
efficients are chosen in a way such that 7fc+i.i7fc+ 2 , 2 7^ 
7fc+i,27fc+2,i is satisfied, based on inequality So span(V) 
= span(F fe+ i 4 ,F fe+ 2,i;P 2 ,i,P2,2; • • • ;Pfc,i, Pfc,2). Based on 
the erMDS property, V is decodable because its linear span 
contains P2+, P3,i, • ■ • , Pfc+2.1 from nodes 2, . . . , k + 2, re- 
spectively. 

QA\ satisfies the erMDS property) Since the file is initially 
stored with Reed-Solomon Codes, the erMDS property is 
satisfied before the repair. Hence there already exist k + 1 
chunks, say p2,i, • ■ • , Pk+2,1, sucn that any RBC containing 
them is decodable. Thus, we only need to check whether for 
the repaired node 1 and any k of nodes 2, . . . , k + 2, there 
always exist k + 1 chunks such that by collecting one chunk 
from each such node, any RBC containing them is decodable. 
Without loss of generality, we just consider the case for the 
repaired node 1 and nodes 2, . . . , k + 1 for simplicity. 

Here, we select the k + 1 chunks in the way that they are 
distinct from those selected for the first round of repair. In this 
case, we collect T\ = {P{ 2 , P2,2, ■ ■ ■ , Pk+1.2} (note: either 
P[ J or P[ 2 is fine). Next we show that the constructed 7^ can 
make any RBC containing T\ decodable. Since the repaired 
node 1 may offer one or two chunks to an RBC, we consider 
two cases. 

Case 1 : The repaired node 1 only offers one chunk. Then the 
RBC needs another k — 1 nodes (e.g., nodes 2, . . . , k) to offer 
all their chunks and another one node (e.g., node fc+1) to offer 
one chunk. To make the RBC include T\, we have the repaired 
node 1 offer P[ 2 and node fc + 1 offer Pfc+i. 2 . Then the 



rbc is lit = {Pl, 2 ;P2,i,P2,2;-^;Pk,uPk,2;Pk+i,2}- B y 

Equation ©, span(Tei) = span(7 fe+ i i2 Pfe+i,i +7fc+2,2-Pfc+2,i; 

P2,l) P2,2! • • • ! Pfe,l) Pfc,2! Pfc+1,2)- 

Based on the MDS property, we consider a decodable 
collection Z = {P 2 +, P2.2, ■ ■ • ; Pfc+1.1, Pfc+i.2}- Then P fc+2 ,i 
is a linear combination of Z, and can be expressed as 

= EE Ag +2) P,„ (9) 

i=2 3 = 1 

where A^ +2 ' is an encoding coefficient for i = 
2,...,fc + 1 and j = 1,2. Thus, the linear span of 
Ki is span(^i) = span((7 fc+ i, 2 + 7fe+2,2A^ 2 ])Pfc + i,i; 
P2.i,P 2 . 2 ; .•■;Pfc,i,Pfc.2;Pfe+i.2})- Note that the coeffi- 
cients are chosen such that 7fe+i,2 + 7fe+2,2A^ +1 [ 7^ 
is satisfied, based on inequality (0. Thus, span(7^i) = 
span(P 2j i,P 2i2 ; . . . ;P fejl ,P fe>2 ). The linear span of TZ\ is a 
decodable collection due to the MDS property. Thus, Tti is 
decodable. 

Case 2: The repaired node 1 offers two chunks. So the 
RBC contains both P[ 1 and P[ 2 . The RBC needs another 
fc — 2 nodes (e.g., nodes 2, . . . , k — 1) to offer all their 
chunks and another two nodes (e.g., nodes k and fc+1) 
to offer one chunk. To make the RBC contain T\, we 
have nodes fc and fc + 1 offer 7\ 2 and Pfc+i. 2 , respec- 
tively. Then the RBC is K 2 = {p|,i,Pi, 2 ; P24, P 2 , 2 ; ■ ■ ■ ; 
Pfc_i,i, Pfc-1,2; Pfc,2; Pfc+i,2}- Similar to the proof of Case 1, 
by Equations @, ©, and (O, the linear span of H2 can be 
expressed as 

span(7e 2 ) = span((7 M + 7fc+2,iA^j f2) )Pfc.i + 
(7fc+i,i +7fc+ 2 .iA^ + + 1 2 |)P fc +i ! i, 

{jk,2 +7fc+2,2Afc fc 1 f2) )Pfc,l + 

(7fc+l,2 +7fc+2,2A^ 4r + 1 2 |)Pfc+l j l, 
P2,l, p2,2; ■ • ■ ; Pfc-1,1, Pfc-1,2! Pfc,2! Pfc+1,2)- 

Note that the coefficients are chosen in a way such 
that (7 M + 7fc+2,iAi fc 1 +2) )(7fc+i,2 + 7fc+2,2Af + + 1 2 j) / 

/ x (fc+2)w \(fc+2h 

(7fc+i,i + 7fc+2,iA^. +1 j)(7fc,2 + 7fc+2,2A^, 1 ') is 
satisfied, based on inequality Thus, span(7^2) = 

span({P 2 ,i,P 2)2 ;...;Pfc+i,i, Pfc+i,2}). The linear span of 
7£ 2 is decodable due to the MDS property. Thus, 72. 2 is 
decodable. 

The r repair (r > 1) Take r = 2 for instance. Suppose 
without loss of generality that node fc + 2 fails. Then we select 
{P{ 2 , P 2 ,2, • ■ • , Pt+1.2} which are distinct from those in the 
first round of repair. We can observe that in fact this set is 
T\ in the first round of repair. As mentioned above, any RBC 
containing T\ is decodable. So T\ can be used for the second 
round of repair. Then we can generate the coefficients that 
satisfy the similar inequalities as (0, (01, and ([6). The proof 
of correctness is similar as r = 1 and thus omitted. 



